DDoS Attacks get Bigger

Friday, October 19, 2012 @ 09:10 AM gHale

They keep getting bigger and bigger: Distributed denial-of-service (DDoS) attacks with an average bandwidth of over 20Gbps are now more commonplace, said researchers at DDoS mitigation vendor Prolexic.

Last year high-bandwidth attacks were isolated incidents, but attacks that exceed 20Gbps in bandwidth occur frequently now, Prolexic’s president Stuart Scholly said Tuesday.

This is significant because very few companies or organizations have the necessary network infrastructure to deal with such attacks. There might be some companies with popular websites such as Google or Facebook capable of handling such high-bandwidth floods, but most companies are not, Scholly said.

Prolexic plans to upgrade the capacity of its own cloud-based DDoS mitigation infrastructure in order to keep pace with the increasing volume of high-bandwidth attacks, he said.

The company released its global DDoS attack report for the third quarter of 2012 on Wednesday. According to report, there’s been an 88 percent increase in the overall number of attacks compared to the same period last year. However, compared to the second quarter of 2012, the number of attacks declined by 14 percent.

The average attack bandwidth during the third quarter of 2012 was 4.9Gbps, which represents a 230 percent increase compared to a year earlier, and an 11 percent increase compared to the previous quarter.

The average attack duration during the third quarter of this year was 19 hours, slightly longer than in the second quarter.

The majority of attacks — over 81 percent — targeted the infrastructure layer, while 18.6% of attacks targeted the application layer, protocols used by specific applications.

The top three countries from where DDoS attacks originated were China with 35 percent of attacks, the U.S. with 28 percent and India with 8 percent.

In the case of high-bandwidth DDoS attacks, attack tactics changed, Scholly said. Instead of using botnets consisting of personal computers, such attacks launch from botnets of compromised servers. The attackers gain access to such servers by exploiting vulnerabilities in outdated Web applications and install PHP-based DDoS toolkits.

One toolkit used to launch high-bandwidth attacks against multiple financial institutions in the U.S., as well as companies from other industry sectors, is “itsoknoproblembro.”